These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T06:16:30.490Z and has not been modified since then. The vulnerability affects SSSD, specifically the sss_nss_protocol_fill_initgr() function in the NSS responder, which pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped. This causes uninitialize [truncated]
The CVE-2026-18739 record indicates an off-by-one error in the poptStuffArgs function of the popt library, which can lead to internal program data corruption. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data. The CVSS score is 2.5, with a LOW severity. Red Hat has a reference for this CVE. Affected product [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T06:16:30.140Z and has not been modified since then. The keycloak-services component of Red Hat Build of Keycloak has a flaw in its backchannel logout endpoint. When an OIDC identity provider is configured to skip signature validation, the system incorrectly accepts logout requests without cryptog [truncated]
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specia [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T03:16:25.537Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This CVE-2026-17614 vulnerability involves a path traversal flaw in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods do not validate that the [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T17:16:33.897Z and has not been modified since then. This CVE-2026-18477 vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows local attackers with write access to influence the restore process. During restoration, files or directories may be created, renamed, or overwritten ou [truncated]
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account th [truncated]
A flaw in GNU tar allows crafted archives to create hardlinks that escape the intended boundary when extracting with the --one-top-level option, potentially allowing writing outside that boundary during a single extraction. This vulnerability, CVE-2026-18508, occurs when hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A [truncated]
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. This issue affects SSSD deployments, particularly those usin [truncated]
A flaw in the keycloak-services component of Keycloak allows an attacker with client management permissions to bypass security policies by creating a public client and updating it to a confidential client with weaker authentication. This issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of [truncated]
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. The vulnerability could lead to unauthorized access to sensitive information or elevated privileges for the newly created [truncated]
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component of Red Hat Build of Keycloak. This issue allows a delegated user to bypass security policies by omitting the fullScopeAllowed field in a request, potentially leading to unauthorized role mappings and client creation with full scope access. Administrators and security teams managing Red Hat Build of Ke [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T16:17:05.387Z and has not been modified since then. This vulnerability in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA), allows an unauthenticated remote attacker to bypass mutual Transport Layer Security (mTLS) authentication for event streams by manipulati [truncated]
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID f [truncated]
A flaw in 389 Directory Server allows unauthenticated remote attackers to inject LDAP search filters into the CleanAllRUV replication status-check extended operation. This can lead to the extraction of sensitive server configuration metadata, including replication bind DNs and password storage scheme information. The CVE record was published on 2026-07-31T10:16:44.720Z and has not been modified since then [truncated]
A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows a user with permission to create Deployments to set the openshift.io/encoded-deployment-config label to 'null', causing ACS to treat the workload as having empty UID, name, and labels, and namespace 'default'. This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and breaks v [truncated]
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a 'not-before' policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshin [truncated]
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate re [truncated]
The CVE record for CVE-2026-18214 was published on 2026-07-31T08:16:27.753Z. Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.610Z and has not been modified since then. The secure-client-uris client policy executor within Keycloak core services enforces security requirements on client configurations, such as requiring encrypted connections for redirect URIs. However, due to an improper check that only looks at [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.467Z and has not been modified since then. The flaw in the keycloak-services component of Keycloak allows attackers to inject duplicate security parameters into the login response by exploiting the security check's limitation to only inspect the query portion of a redirect URL and ignore [truncated]
A flaw in the Keycloak OIDC token introspection endpoint allows unauthorized clients to access sensitive information in tokens issued for different audiences. The endpoint correctly identifies tokens as inactive for certain clients but returns full token claims within a signed JWT field. This issue arises when confidential clients configured for signed JWT introspection responses attempt to introspect tok [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.010Z and has not been modified since then. This CVE-2026-18203 record details a flaw in Keycloak's group policy evaluation logic, allowing unauthorized access via a text-based prefix check vulnerability. The vulnerability occurs when a group policy is set to extend permissions to child g [truncated]
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T03:16:25.223Z and has not been modified since then. The vulnerability in yggdrasil-worker-package-manager allows local attackers to inject arguments in the APT backend through specially crafted package names starting with a hyphen, potentially leading to remote code execution with root privileges [truncated]
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if th [truncated]
A flaw in Dogtag PKI's ACME responder allows unauthenticated ACME account holders to perform server-side request forgery (SSRF), causing the Dogtag server to send HTTP GET requests to internal network services. With the InMemory database backend, response bodies of internal targets are disclosed to the attacker through ACME challenge errors. Defenders should assess exposure and verify internal network ser [truncated]
The CVE-2026-16530 record was published on 2026-07-30T06:25:03.113Z. A flaw in the PCP `pmproxy` service's `pmLogLoadInDom()` function can be exploited by a remote attacker to bypass a critical bounds check, potentially causing a Denial of Service and leaking sensitive information from the system's memory. System administrators and security teams should review the official CVE record and assess their expo [truncated]
An executive overview of CVE-2026-16527: This high-severity vulnerability affects the PCP pmproxy service, allowing an unauthenticated remote attacker to bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This could lead to arbitrary code execution and system takeover. System administrators and security teams should be aware of the potential impact and take immediate ac [truncated]